Analyzing Volatile Windows Event Artifacts GCFA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   You are analyzing a memory dump and notice that the System event log contains Event ID 6005 (Event Log service started) at 08:00:00, but the Security log contains Event ID 4624 (logon) records with timestamps starting at 07:55:00. What is the most likely explanation?

   • AThe system clock was changed after boot, causing the logon events to appear earlier than the service start.
   • BThe memory dump is corrupted and the timestamps are unreliable.
   • CThe Security log records are from a previous boot session and were loaded into memory when the system started.
   • DThe Event Log service started before the system boot, which is impossible.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which security event ID is commonly associated with a failed logon attempt?

   • A4634
   • B4625
   • C4648
   • D4624
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a typical use of the Windows System event log in a forensic investigation?

   • AStoring network packet captures
   • BIdentifying system crashes, driver failures, and service start/stop events
   • CTracking user logon and logoff activity
   • DRecording application-specific errors like database failures
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   You are investigating a suspicious logon on a Windows Server. From a memory dump, you extract an event ID 4624 logon for a service account at 02:00:00. You also find a scheduled task that runs at 02:00:00 and a process that started at 02:00:01. The service account has the 'Log on as a service' right. What is the most likely relationship between these artifacts?

   • AThe logon and process are coincidental and not related
   • BThe logon was a result of a remote user, and the scheduled task is unrelated
   • CThe process is a malicious process that caused the logon
   • DThe scheduled task triggered the logon, and the process is the result of the task
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   You are analyzing a memory dump from a Windows 10 system. The extracted Security event log shows event ID 4624 logons for a user at 10:00, 10:05, and 10:10, but there is a gap between 10:10 and 10:30. You also find that the event log service was restarted at 10:15. Which explanation is most likely for the gap?

   • AThe system was rebooted, and the event log was cleared during startup
   • BThe user simply did not log on during that time period
   • CThe event log service restart caused a temporary loss of event logging, and the gap is due to the service being unavailable
   • DAn attacker cleared the event log, and the service restart was part of the attack
   Reveal Solution Discussion Select an answer first